Skip to content

fix(docker): patch the base-OS pcre2 CVE in the nginx images #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
santidev21 merged 1 commit into from
Oct 1, 2026
Merged

fix(docker): patch the base-OS pcre2 CVE in the nginx images #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions docker/frontend/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,11 @@ RUN npm run build -- --configuration production
# Stage 2: Serve static files with Nginx Alpine
FROM nginx:1.31-alpine AS final

# Install wget and upgrade Alpine packages to patch base OS vulnerabilities
RUN apk add --no-cache wget && apk upgrade --no-cache
# Install wget and upgrade Alpine packages to patch base OS vulnerabilities.
# pcre2 is listed explicitly because CVE-2026-103111 (fixed in 10.49-r0) is not
# yet in the published nginx image, and a cached `apk upgrade` layer would keep
# serving the vulnerable package.
RUN apk add --no-cache wget 'pcre2>=10.49-r0' && apk upgrade --no-cache

# Copy custom Nginx configuration
COPY docker/frontend/nginx.conf /etc/nginx/conf.d/default.conf
Expand Down
4 changes: 3 additions & 1 deletion docker/proxy/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ FROM nginx:1.31-alpine

# Install openssl for self-signed certificate generation in local/test mode.
# gettext provides envsubst for rendering the nginx template at runtime.
RUN apk add --no-cache openssl gettext && apk upgrade --no-cache
# pcre2 is listed explicitly because CVE-2026-103111 (fixed in 10.49-r0) is not
# yet in the published nginx image.
RUN apk add --no-cache openssl gettext 'pcre2>=10.49-r0' && apk upgrade --no-cache

# Create non-root-friendly directories and set ownership.
# Nginx alpine image provides nginx user (UID 101) / group (GID 101).
Expand Down
Loading